1. Information We Collect

In operating the wholesale clearing gateway, INDGM Core collects and processes:

• Merchant Profile Data: Legal business name, corporate registration numbers, registered domain, and corporate email addresses.
• Compliance Verification Records: Identity documents, proof of corporate incorporation, and tax identification numbers stored on encrypted, access-controlled volumes.
• Operational Telemetry: Origin IP addresses, webhook delivery logs, API latency metrics, and cryptographic order idempotency keys.
• Target Delivery Metadata: End-user gamer IDs and zone numbers necessary to route fulfillment to upstream game publisher nodes. We do not solicit or store consumer credit card data.

2. Integration with Google Workspace SSO

When authenticating through Google Single Sign-On (SSO), we access only your basic account profile (name, email address, and unique Google account identifier) to verify your enterprise identity against authorized merchant profiles. We do not access files, calendars, or private mailbox contents.

3. Cryptographic Storage & Document Protection

All sensitive KYC and corporate verification records are stored off the public web root in private storage disks. Digital vouchers and PIN keys dispatched to transactions are encrypted at rest using AES-256-GCM authenticated encryption. Administrative access to raw verification data is restricted and logged within the immutable Security Audit Journal.

4. Third-Party Upstream Disclosures

To fulfill instant top-up requests, end-user game credentials (such as Target Account ID and Zone/Server ID) are transmitted via encrypted TLS connections to direct supplier nodes (e.g., SmileOne). We do not monetize, rent, or transfer corporate merchant data to advertising networks or third-party brokers.

5. Compliance & Regulatory Inquiries

The Platform may disclose relevant merchant audit entries and transaction logs where strictly mandated by applicable cross-border anti-money laundering (AML) statutes or valid judicial orders.